OneDriveServer.zip
- SHA256 7adffc1c0b3fdcba46e8d0a81203c955976d4ef39893c98d0b2dbfbb8d6a8ec3
Overview
overview
3Static
static
3OneDriveSe...nt.dll
windows10-2004-x64
1OneDriveSe...nt.dll
windows11-21h2-x64
1OneDriveSe...ce.dll
windows10-2004-x64
1OneDriveSe...ce.dll
windows11-21h2-x64
1OneDriveSe...ce.exe
windows10-2004-x64
3OneDriveSe...ce.exe
windows11-21h2-x64
3OneDriveSe...re.dll
windows10-2004-x64
1OneDriveSe...re.dll
windows11-21h2-x64
1OneDriveSe...ws.dll
windows10-2004-x64
1OneDriveSe...ws.dll
windows11-21h2-x64
1OneDriveSe...ll.exe
windows10-2004-x64
1OneDriveSe...ll.exe
windows11-21h2-x64
1OneDriveSe...nt.exe
windows10-2004-x64
1OneDriveSe...nt.exe
windows11-21h2-x64
1OneDriveSe...er.exe
windows10-2004-x64
3OneDriveSe...er.exe
windows11-21h2-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OneDriveServer/OneDriveServer/ScreenConnect.Client.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
OneDriveServer/OneDriveServer/ScreenConnect.Client.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
OneDriveServer/OneDriveServer/ScreenConnect.Core.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
OneDriveServer/OneDriveServer/ScreenConnect.Core.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
OneDriveServer/OneDriveServer/ScreenConnect.Windows.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
OneDriveServer/OneDriveServer/ScreenConnect.Windows.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
OneDriveServer/OneDriveServer/ScreenConnect.WindowsBackstageShell.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
OneDriveServer/OneDriveServer/ScreenConnect.WindowsBackstageShell.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
OneDriveServer/OneDriveServer/ScreenConnect.WindowsClient.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
OneDriveServer/OneDriveServer/ScreenConnect.WindowsClient.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
OneDriveServer/OneDriveServer/ScreenConnect.WindowsFileManager.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
OneDriveServer/OneDriveServer/ScreenConnect.WindowsFileManager.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target OneDriveServer.zip
- Size 1.7MB
- Sample260417-pgp2msdv2n
- SHA256 7adffc1c0b3fdcba46e8d0a81203c955976d4ef39893c98d0b2dbfbb8d6a8ec3
- MD5 752a7188f2bab1926a63254e29f3108a
- SHA1 3cf97b5207e51a1ae8e640450279abef204f0466
- SHA512 29e00995e35d5b6ac58d33e6e8296b867a9e0a9fe721b657e99dfe9793200097176156a90dcffd8de48403e43a5f8f5551ddc444154aa168912c8049d6eafa22
- SSDEEP 49152:xVN9Mu/qTBHt+CBJqbe9BkitnoDfqfTurHUezJ/T:xVI+uBHtFqbUkiNWfCTo0ed
- TLSH T1C08533F7AEA65EFA183DC41CE60789812013376EED92FC43A971541116F8B925BFB2C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/OneDriveServer/OneDriveServer/ScreenConnect.Core.dll
File Explorer
-
OneDriveServer.zip.zip 1.7MB
-
OneDriveServer/OneDriveServer/Client.en-US.resources64KB
-
OneDriveServer/OneDriveServer/Client.resources6KB
-
OneDriveServer/OneDriveServer/ScreenConnect.Client.dll.dll 399KB
-
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.dll.dll 78KB
-
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.exe.exe 93KB
-
OneDriveServer/OneDriveServer/ScreenConnect.Core.dll.dll 537KB
-
OneDriveServer/OneDriveServer/ScreenConnect.Windows.dll.dll 1.7MB
-
OneDriveServer/OneDriveServer/ScreenConnect.WindowsBackstageShell.exe.exe 59KB
-
OneDriveServer/OneDriveServer/ScreenConnect.WindowsBackstageShell.exe.config.xml 266B
-
OneDriveServer/OneDriveServer/ScreenConnect.WindowsClient.exe.exe 604KB
-
OneDriveServer/OneDriveServer/ScreenConnect.WindowsClient.exe.config.xml 266B
-
OneDriveServer/OneDriveServer/ScreenConnect.WindowsFileManager.exe.exe 79KB
-
OneDriveServer/OneDriveServer/ScreenConnect.WindowsFileManager.exe.config.xml 266B
-
OneDriveServer/OneDriveServer/app.config508B
OneDriveServer/OneDriveServer/Client.en-US.resources
- SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
- MD5 92232708774febf9a4a464bbeda36215
- SHA1 521d4e630f5e00977bbca7cd17dd0d22dbe1ca9e
- SHA512 59442cbc57604f0dd170bb4f86f0e2b6c96408daf67250e6f40e00d034033b6871502cd83df0267f4628c3a035f191d56f26bf1927e691b5330524eb810852f2
- SSDEEP 1536:5fkiK2FoQ67wwLFSj7Be3sZvU/7UFN+9nwLLChTKN1ljpneMarA:5fkiK2FoQ6jFSj7Be3sZvU/7UFN+9nwS
- TLSH T1A8532E1277FD0A58F5F36F35BE7A94619937BC5A2E25C06E1028815E09B2F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
OneDriveServer/OneDriveServer/Client.resources
- SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
- MD5 1e863134f29bcabe1ee571c91ac4fbe6
- SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
- SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
- SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
- TLSH T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
- MD5 SHA1 SHA512 SSDEEP TLSH
OneDriveServer/OneDriveServer/ScreenConnect.Client.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c24f3f38cbad5591ca72bd3688b3bcc67b311143e3418905752a88887c649c12
- MD5 73f5f4033295f0cb4fe0347f677f7ba6
- SHA1 c1fe83c93d7c3ed97a8405a2c75317dd4c80eead
- SHA512 5e68abf0345490829f3e43174a72d1e043a89c94d07adf5a26e367aaa45ae57ec0d51e7a8ef3c2f116ca153eb0ae1952ce922f4fd980d8fa7a247293a47b61e0
- SSDEEP 6144:oMq4l+PvJNOZvD8ETEavHy+vd7JPYIYyqQni65/PGM:/5+25DHTEavSW7OQni3M
- TLSH T13694BF86B3A44C6DFB6F0A77F45041299E73AC456552F26D4E04B8F90AB3BD28740BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:48:f7:a0:67:a7:ec:a1:f1:73:be:43:12:3c:8b:84:52:7f:a2:d2:0c:73:99:44:de:52:b6:49:00:ae:e8:e4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Dec 18, 2025
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
09:58:e3:aa:36:86:68:05:ee:3c:35:c1:56:88:98:22
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 23, 2025 - Jun 22, 2028
Minor OS version
0
Major OS version
4
Entry point
404234
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb
mscoree
_CorDllMain
Name
.text
Size
387KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 881377643cc610e41a458b2797ac8ca4f018d3f39a1effd40b521ebb52c5e7af
- MD5 4ec378ab38ad1512899de74ed30da605
- SHA1 06324f0f48c51d97fca0222d3ab2a9f1a84561b9
- SHA512 1dd6e2967f44dcc5354abf5c12ace9204df1b6dc6072dd901301677861cd48e62cfb543647059d0a2c698ac6a01cf73d52c53c37e28afe0fd78fb29dfa2ecd7f
- SSDEEP 1536:z7xQmiDHn5f2yoI4vn3R0asV7k/QQV3lTwmkbP5Ck7l:z7xQmKH5eygf3R0T0QQVFwzCkJ
- TLSH T118734C81A3AC5E26C9DF4F387465B0450F709A02D4A3FBDD9D8EA4EA1B563C12E043DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:bf:4e:18:df:e9:61:3a:5a:29:71:62:06:21:9a:2f:13:a6:c3:4f:d6:f3:08:08:24:6a:09:33:49:18:bb:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Dec 18, 2025
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
09:58:e3:aa:36:86:68:05:ee:3c:35:c1:56:88:98:22
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 23, 2025 - Jun 22, 2028
Minor OS version
0
Major OS version
4
Entry point
75758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb
mscoree
_CorDllMain
Name
.text
Size
66KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OneDriveServer/OneDriveServer/ScreenConnect.ClientService.exe
- IMPHASH 5f510e22d141c137199e2ff4021a57be
- SHA256 ecd5ed16975d556d1d17bc980f248f8a5262bed11df9d9cf999efd9c273c11df
- MD5 fcb58cddda40825616c70c93b312a79a
- SHA1 94acd6b46cce2a0b84cc5efad3e661eeaa58a612
- SHA512 6f49c9bcb3e0fd81516996b2dfa805e373577d33a5313bb5df209d2ff845e68dc569297b10408d15eb506790f1b588c96ed030efb7ea3a57ec7c5b010a3d4748
- SSDEEP 1536:gg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgcrU0HMX7dFo:JhbNDxZGXfdHrX7rAc6myJkgcrU0He7o
- TLSH T1C6935A13B5C28872D573093158E0DAB09A7FF9615E21DEAB3788022E4F741C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
08:7b:cd:d5:3e:9c:49:46:a5:4b:4b:e1:a9:77:17:dc:52:ff:af:74:bb:d7:00:44:c4:0b:1d:69:e4:6d:17:00
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Dec 18, 2025
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
09:58:e3:aa:36:86:68:05:ee:3c:35:c1:56:88:98:22
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 23, 2025 - Jun 22, 2028
Minor OS version
1
Major OS version
5
Entry point
8575
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb
mscoree
CorBindToRuntimeEx
shlwapi
StrCatW
PathFindFileNameW
StrCpyW
PathRemoveExtensionW
kernel32
SetEvent
CloseHandle
LoadLibraryW
DecodePointer
GetProcAddress
GetLastError
GetCurrentProcessId
GetModuleHandleW
SetStdHandle
Sleep
CreateEventW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetCommandLineW
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DeleteCriticalSection
RtlUnwind
GetFileType
GetProcessHeap
FreeEnvironmentStringsW
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
HeapFree
HeapSize
HeapReAlloc
LCMapStringW
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
advapi32
RegisterServiceCtrlHandlerExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
RegSetValueExW
StartServiceW
RegCreateKeyW
StartServiceCtrlDispatcherW
OpenServiceW
RegOpenKeyW
oleaut32
VariantInit
SysFreeString
SysAllocString
SafeArrayPutElement
SafeArrayCreateVector
VariantClear
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=122, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=260, version=31616,
count=20, id=259, version=31616,
count=42, id=261, version=31616,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=112, id=1, productName=Unmarked objects,
count=1, id=265, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
OneDriveServer/OneDriveServer/ScreenConnect.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a1f0f3a87ee881d118234fe467b7dc7edee33cc67735380d60134d522b38fc6
- MD5 5506ccec11c6e686d88bb3b929891659
- SHA1 5986a191d71063b7da8a7639277f60cd32437c8d
- SHA512 7e3b579ced5e2528408eb93460b948faf6fdc7a1f03ed5a31fddfe3bc15493bebaa909f98eb508a8ea6b38a8ebfeb91cead85e0134b4d3700a370d4a1c614058
- SSDEEP 12288:h9Pv9VBxU3n3yXARw/OZ6bzZi0eog57eqeuuTZRB3lFbyks10:7zYyAMxds10
- TLSH T17CC45A4A33D89336C99F47BEB8309A440B71E415A53BE75B7E30F6AA1D833444F452EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
556526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
535KB
Virtual Size
535KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OneDriveServer/OneDriveServer/ScreenConnect.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cea1d85967d2c456fccecae3a70ff2adfe4c113aacf9d18c35906c2ed24ca9b4
- MD5 cdc55f204dd2d7e2240d5b785250e68d
- SHA1 19e1234a94f0445e8fdb9ae0f75554292db48c1c
- SHA512 8db2842b8ecb7508604da882632a98580f849a266431f417d740acfdac4f0eb19bec6ee80b4f99af3152feab49f952dfa29f00ce0eb33e25ddbf6f53b3a5fcdd
- SSDEEP 24576:15psFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTp:bpsJkGYYpT0+TFiH7efPk
- TLSH T1D085AD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE356D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
57:44:9e:a0:ef:4a:c0:55:e7:22:60:b3:0d:85:4d:c8:42:a5:56:0c:e1:ca:ea:7c:27:bb:e4:37:e3:64:2a:49
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Dec 18, 2025
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
09:58:e3:aa:36:86:68:05:ee:3c:35:c1:56:88:98:22
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 23, 2025 - Jun 22, 2028
Minor OS version
0
Major OS version
4
Entry point
1738018
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OneDriveServer/OneDriveServer/ScreenConnect.WindowsBackstageShell.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4a5ab50d7c2b63271dc1972f996b1af87d4ab9143a9df10d858ca7134afebc5e
- MD5 5b86dbd8a8a9693958f720550e07924d
- SHA1 4969ce6ffac0c73f82c20bfd6deed43d7bce361a
- SHA512 225a5c62c15876ec6a80a523ca197c3dfeea1fd905cf8a1b16f05c27b151d56fed5c1a4d0cf01df2b834eae1cb67e4c9ee363b1b677de02bafc8b64e0f1cae30
- SSDEEP 1536:ooSOs/MRZFe9aqVDvmDTyQX5E+TC7rh2syGbUc+7qE:ooTsCZFe9RmyQOjIc+2E
- TLSH T156538E5163E84615C9FF2E7CB8F2A1141EB1AA439441EBAE0DCD65EA0E537816F203E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:47:fd:d1:10:97:b7:ba:17:d0:6a:82:c7:f3:d1:6c:72:a5:9d:49:43:a5:36:b6:75:bb:c1:ab:60:6c:41:25
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Dec 18, 2025
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
09:58:e3:aa:36:86:68:05:ee:3c:35:c1:56:88:98:22
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 23, 2025 - Jun 22, 2028
Minor OS version
0
Major OS version
4
Entry point
55606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\builds\cc\cwcontrol\Product\WindowsBackstageShell\obj\Release\ScreenConnect.WindowsBackstageShell.pdb
mscoree
_CorExeMain
Name
.text
Size
46KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OneDriveServer/OneDriveServer/ScreenConnect.WindowsBackstageShell.exe.config
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
OneDriveServer/OneDriveServer/ScreenConnect.WindowsClient.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7cd74f5e0fb8b9cdf3275a03ac29f25c88a2adea7afa1a1a0e719a54be9d9e2b
- MD5 f4f235efd9873261762b4d940972d756
- SHA1 9a329c0692f3159113ebbd5daab0e11647415bce
- SHA512 68adf767d82b243e171fafc6675f41fd907d6374393e9067f26ac854cc3af3936c5be2b30257d4bab079d63efb01409f2ec82d43d3a9ccca3524e1e2e803db37
- SSDEEP 12288:6yZ/agpEXLJSHIUf8QpnsdW4B1bjQchpiF9zi9mMd:7SXLglsdWS1tpQ2oMd
- TLSH T19CD46BA177FC9A3BC8EF0779B0E1142757B0E845B686E78E4904A4D90EC73916E483E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
05:36:60:40:1b:90:3e:a7:21:c3:6b:ad:62:cb:9b:53:45:85:ce:ea:de:d5:e5:ff:49:21:3f:76:91:e2:c3:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Dec 18, 2025
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
09:58:e3:aa:36:86:68:05:ee:3c:35:c1:56:88:98:22
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 23, 2025 - Jun 22, 2028
Minor OS version
0
Major OS version
4
Entry point
612590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb
mscoree
_CorExeMain
Name
.text
Size
592KB
Virtual Size
591KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OneDriveServer/OneDriveServer/ScreenConnect.WindowsClient.exe.config
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
OneDriveServer/OneDriveServer/ScreenConnect.WindowsFileManager.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0fdc044e6e6be34d0654bc7858e10d022bd8c115c16cdd157184aca08715e45b
- MD5 8a42171f41094a13b86a2b4fda8c3920
- SHA1 cb348ed6424fd169ae190d1d249bef5fd27f3b24
- SHA512 c9de08d5bbb788499c039e55ff5e3abcb46f1ba00096026d897a5bb08db0daf716bbdb1e7a53ae0dabd9ac1bcec0d835ecdfcbeaae6a62dcd27398f26201c7d9
- SSDEEP 1536:Ety6l44tzbwSI5kLP+VVVVVVVVVVVVVVVVVVVVVVVVVC7AJO7k:PUTukLd8JOA
- TLSH T1FF83E68235762231DF85C5379492C9B59D366F22133DC5BD2DA2FE3A69F03443A8ADB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a5:e8:27:86:08:3e:bc:30:cd:3f:46:35:74:22:1e:53:cd:63:6f:da:52:6d:e1:cf:bd:a4:f5:a5:5d:a9:bc:ec
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Chains
Dec 18, 2025
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US
Serial Number
09:58:e3:aa:36:86:68:05:ee:3c:35:c1:56:88:98:22
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 23, 2025 - Jun 22, 2028
Minor OS version
0
Major OS version
4
Entry point
24294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb
mscoree
_CorExeMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
OneDriveServer/OneDriveServer/ScreenConnect.WindowsFileManager.exe.config
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
OneDriveServer/OneDriveServer/app.config
- SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
- MD5 7b5bfce1109ea50893d85f908066f4eb
- SHA1 49dee30e332dab3251af37a9c4b2cf99c1493f72
- SHA512 c3fda557c4deba5d4be1e279e711fcd09d8eb15f445d8ebd733ced7d493a9a6cad74e56c2847489275a3d8dbdec8bfd21bc097600a1288adff9b7f6921c5e3ba
- TLSH T115F0E91432047E5B1A871F33C53346102DB16E722221242D64AB303BF67A6E513B23C7
- MD5 SHA1 SHA512 TLSH